FR2792479A1 - Secret digital word telephone loading technique having digital data cyphered/second module sent with second module decyphering/digital key producing/special memory area storing - Google Patents

Abstract

The technique involves loading the data (DATA) from a first module (S) to a second non volatile memory module (SAM) with a secret digital data store (EF). The data is coded in the first module, and sent to the second module. The data is decyphered in the second module, and a cyphered digital key (DATAC) produced. The digital key is stored in the secret digital data store.

Description

!

  METHOD FOR SECURE LOADING OF DATA BETWEEN

SECURITY MODULES

  The present invention relates to a method for securely loading at least one secret data from a first security module to one or more second security modules, said first module comprising secret data, said second module comprising a non-volatile memory , said memory

  comprising at least one file containing secret data.

  The invention finds a particularly advantageous application

in the field of telephony.

  In the field of telephony, there are terminal administration systems which comprise a first security module embedded in an administration server and second security modules generally embedded in the aforementioned terminals. The terminals are payphones or concentrators of payphones. A hub is connected to said server and manages

  several payphones. It consists of a computer.

  A second security module guarantees the validity of a user card inserted in a payphone, in particular through authentication of said card. To this end, said second module comprises in its non-volatile memory secret data making it possible to guarantee said validity of the user cards. The terminal administration systems as well as the secret data are managed by telephone operators. Secret data is

  are found in a file in the terminal's second security module.

  In order to reduce the risk of fraud consisting in spying on a communication network connecting the server and the terminals and thus in discovering said secret data, each operator is required to regularly modify in the second security module of the terminal all or part of the secret data that 'it manages, from 2 secret data from the first security module of the administration server. In the same way, in order to take into account new user cards, new secret data are updated or added in said terminal.5 A method known in the art comprises the steps according to which: - the secret data is encrypted found in the administration server which must be transmitted to the second security module of the terminal, the terminal connects to the administration server when no conversation is in progress, - the secret data are transmitted from the first security module of said server at the terminal's second security module. When a large number of secret data, managed by said operator, must be transmitted to the second security module, the process is carried out several times, which makes it possible to load several

  secret data sequentially.

  Although this method allows loading of secret data between a first and second security module, when the second security module is powered down in the terminal, for example for reasons of energy saving, sequential loading can to be broken. Consequently, the second module comprises a non-coherent set of secret data managed by the operator and used in the terminal, said set comprising old and new secret data. The second security module no longer works with said set of secret data and the terminal can no longer work with the user cards corresponding to said

secret data.

  Also, a technical problem to be solved by the object of the present invention is to propose a method for secure loading of at least one secret datum from a first security module to one or more second security modules, said first module comprising secret data, said second module comprising a non-volatile memory, said memory comprising at least one file comprising secret data, which would guarantee consistency between the secret data managed by the same operator and used by a second security module , even after switching off the latter, and obtaining

  thus optimum use of the associated terminal.

  A solution to the technical problem posed is characterized, according to the invention, in that said loading method comprises the steps according to which: - at least one secret datum of the first module is encrypted, the encrypted secret datum is sent to the second module, - the encrypted secret data is decrypted in the second module, said decrypted secret data is recorded in the second module, said recording being made in a memory location of the non-volatile memory,

- the secret data is activated.

  Thus, as will be seen in detail below, the loading method of the invention allows, thanks to the activation step, to defer the use of one or more secret data, and this, the time

  recording of all useful secret data.

  The description which will follow with regard to the appended drawings,

  given by way of nonlimiting example, will make it clear how

  consists of the invention and how it can be realized.

  Figure 1 is a diagram showing a first module of

  security and several second security modules.

  Figure 2 is a diagram showing an exchange of data between

  the first module and a second module in FIG. 1.

  Figure 3 is a diagram showing a second exchange of

  data between the first module and the second module in Figure 2.

  Figure 4 is a diagram showing a second module of the

figure 1.

  FIG. 1 shows a first security module S and several second security SAM modules. The first module S is integrated into a terminal administration server SERV and includes secret data DATA. The second SAM modules are integrated into said terminals T. Each second SAM module includes a non-volatile MEM memory. The non-volatile MEM memory comprises at least one file EF comprising secret data DATA. Said secret data DATA of an EF file is

  used in terminal T by the second SAM security module.

  In a first embodiment, the first security module S of the administration server SERV is a secure database comprising secret data DATA. In a second embodiment, said security module S is either a smart card comprising a card body in which an integrated circuit device is incorporated, or, said device itself. Said device is an electronic module comprising an integrated circuit chip or the chip itself. The second terminal T security module SAM is either,

  a smart card, or an integrated circuit device.

  In order to modify a secret data item DATA of the second SAM module, a secret data item DATA is loaded from the first security module S. The loading phase includes several stages

described below.

  In a first step, in the administration server SERV, at least one secret data item DATA of the first module S is encrypted, said secret data item DATA having to be transmitted in the second module SAM. The encryption comprises an encryption step using5 an ALGO encryption algorithm generally found in the first module S in the case where this is a smart card, and, in this case, said encryption is carried out in said first module, as shown in FIG. 2. The encryption can also include, on the one hand, a step of signing the secret DATA data making it possible to verify the authenticity of said data data, and, on the other hand, a step of certifying the secret data DATA making it possible to verify its integrity. The encryption and decryption can also be a function of random data RAND generated in the second SAM module and recorded in the non-volatile MEM memory of the second SAM security module (not shown). Said random data RAND is sent to the first security module S in order to perfectly diversify the secret data DATA transmitted. The fact that the random data is recorded in the non-volatile MEM memory makes it possible, after switching off the second SAM module, on the one hand, to always be able to decrypt the secret data DATA in said second SAM module, the decryption depending on said random data RAND, and, on the other hand, to be able to continue the

  loading of the same batch of secret data.

  In a second step, the encrypted secret data DATAC is sent to the second SAM module. The sending can be done, either, by means of a hertzian telecommunications network, or, by means of any

  other known type of communications network.

  In a third step, the encrypted secret data DATAC is deciphered in the second SAM module. The decryption is done from an ALGOP algorithm for reverse decryption of the ALGO algorithm used for encryption, said ALGOP algorithm for decryption

  advantageously found in the second SAM module.

  In a fourth step, said decrypted secret data DATA is recorded in the second SAM module, said recording being made in a memory location M of the non-volatile memory MEM. In order to choose the memory location M in which the secret data DATA is to be stored, prior to sending the secret data DATA, the appropriate memory location M is selected. Finally, in a last step, said secret data DATA is activated. As the second SAM module can comprise several EF files comprising secret DATA data, prior to the activation of the secret data DATA in the second SAM module, an EF file comprising secret DATA data is selected from said second SAM module. As shown in FIG. 3, the activation of the secret data DATA is a transfer of said secret data from the memory location M to the file EF of the second module SAM. Said activation is done by means of a first ACTIVATE command sent from the terminal T to the second security SAM module. Similarly, the sending, decryption and recording of the secret data DATA in the second SAM module is done by means of a second LOAD command sent from the terminal T to the second SAM security module (not shown). Before each command, an ORD order is sent from the SERV server to the terminal in order to trigger a bet.

implementation of said order.

  A second SAM security module commonly manages different types of user cards and consequently comprises several secret data DATA associated with each type of user card, a type of card commonly corresponding to a given operator, supplier of said cards. Preferably, all of the secret DATA data managed by an operator is found in an EF file of the second security module SAM. As shown in the example in FIG. 4, the second SAM module manages three different types of cards and consequently comprises three EF files. In order to keep good consistency between the secret data DATA of an EF file, all or part of the secret data DATA associated with a type of cards is modified, when, for example, one of said

  secret data DATA is out of date or has been fraudulently altered.

  Also, in the case where several secret DATA data are modified, according to the method of the present invention, the steps are implemented on a plurality of secret DATA data, the activation step being implemented when all of the plurality of said data

  DATA secret of an EF file has been saved.

  Thus, in the first module S of the administration server SERV, depending on the operator, the secret data DATA to be transmitted is selected and said secret data is encrypted. Subsequently, depending on the capacity of the communications network used, the encrypted secret data DATAC is sent, one by one or by block of data in the second SAM security module, it is decrypted and recorded in the memory location M MEM memory

  non-volatile as described previously in the fourth step.

  Said secret data DATA is not yet used by the

second SAM module.

  In order to simplify the management of the secret data DATA corresponding to different operators, a memory location M is associated with a file EF comprising secret data DATA. Thus, according to the example of FIG. 4, the second SAM module comprises three memory locations M1, M2 and M3 associated respectively with the three files EF1, EF2 and EF3. In an advantageous embodiment, an EF file of the second security module includes a memory location M. Thus the files EF1, EF2 and EF3 each comprise, on the one hand, on the one hand, a memory area Z1, Z2 and Z3 respectively containing secret data. DATA used during the operation of the terminal T, and, on the other hand, a memory location M 1, M2 and M3, comprising secret data DATA which are not yet used. In this case, the selection of the memory location M is done by means of the associated EF file, for example, by a

file identifier.

  In order to choose the secret data DATA to be modified in the second SAM module, an EF file is first selected in said second SAM module, said file corresponding to said secret data concerned. Thereafter, the activation is preferably done when the terminal T is little used, for example at night, so as not to disturb the users. At this time the terminal is unavailable for any use. Advantageously, the activation is done when the secret data DATA of all the terminals T have been transmitted, so that all the data are activated at the same time in each terminal T. After the activation of the data, said secret data DATA transmitted from the administration server SERV can be used in the terminal T. Thus, thanks to the method of the present invention, even after the second SAM module is powered down and all the secret data DATA to be transmitted and corresponding to a given operator has not yet been transmitted, the terminal T comprising the second SAM module always works with the cards of said operator. In fact, all of the secret DATA data managed by said operator, included in the associated EF file and used by said second SAM module, remain consistent with one another 9 since none is modified before said activation step of the present invention. Of course, the invention is by no means limited to the field of telephony, it can extend to other fields in which a data exchange system is implemented between a centralized module having secret data and relocated modules

  able to receive said secret data.

Claims (7)

  1 - Method for securely loading at least one secret data (DATA) from a first security module (S) to one or more second security modules (SAM), said first module (S) comprising secret data (DATA), said second module (SAM) comprising a non-volatile memory (MEM), said memory comprising at least one file (EF) comprising secret data (DATA), characterized in that it comprises the steps according to which: - at least one secret datum (DATA) of the first module (S) is encrypted, - the encrypted secret datum (DATAC) is sent to the second module (SAM), - the encrypted secret datum (DATAC) is deciphered in the second module (SAM) ), - the decrypted secret data (DATA) is recorded in the second module (SAM), said recording being made in a memory location (M) of the non-volatile memory (MEM),   - the secret data (DATA) is activated.   2 - Method according to one of the preceding claims,   characterized in that said activation is done by means of a first order (ACTIVATE).   3 - Method according to one of the preceding claims,   characterized in that it further comprises an additional step according to which: - prior to the activation of the secret datum (DATA) in the second module (SAM), a file (EF) is selected in the said second II module (SAM) ) with secret data (DATA).   4 - Method according to one of the preceding claims,   characterized in that a memory location (M) is associated with a file (EF) comprising secret data (DATA).   - Method according to one of the preceding claims,   characterized in that a file (EF) of the second module (SAM) of   security has a memory location (M).   6 - Method according to one of the preceding claims,   characterized in that it further comprises an additional step according to which: - before sending the secret data (DATA), we   selects the memory location (M).   7 - Method according to one of the preceding claims,   ] 5 characterized in that the sending, decryption and recording of the secret data (DATA) in the second module (SAM) is   done by means of a second command (LOAD).   8 - Method according to one of the preceding claims,   characterized in that the steps are implemented on a plurality of secret data (DATA), the activation step being implemented when all of the plurality of said data   secret (DATA) of a file (EF) has been saved.